System and method for identifying and assessing vulnerabilities on a mobile communications device

ABSTRACT

The invention is a system and method for identifying, assessing, and responding to vulnerabilities on a mobile communication device. Information about the mobile communication device, such as its operating system, firmware version, or software configuration, is transmitted to a server for assessment. The server accesses a data storage storing information about vulnerabilities. Based on the received information, the server may identify those vulnerabilities affecting the mobile communication device, and may transmit a notification to remediate those vulnerabilities. The server may also transmit result information about the vulnerabilities affecting the mobile communication device. The server may also store the received information about the device, so that in the event the server learns of new vulnerabilities, it may continue to assess whether the device is affected, and may accordingly notify or remediate the device. The server may provide an interface for an administrator to manage the system and respond to security issues.

This is an application for reissue of U.S. Pat. No. 8,397,301 B2, and isa continuation of application Ser. No. 14/109,725, which is also anapplication for reissue of U.S. Pat. No. 8,397,301 B2.

FIELD

The invention relates generally to mobile security, and specifically, toassessing the vulnerability of a mobile communication device.

BACKGROUND

Mobile communication devices or mobile devices, such as cellulartelephones, smartphones, wireless-enabled personal data assistants, andthe like, are becoming more popular as cellular and wireless networkproviders are able to expand coverage and increase bandwidth. Mobiledevices have evolved beyond providing simple telephone functionality andare now highly complex multifunctional devices with capabilitiesrivaling those of desktop or laptop computers. In addition to voicecommunications, many mobile devices are capable of text messaging,e-mail communications, internet access, and the ability to runfull-featured application software. Mobile devices can use thesecapabilities to perform online transactions such as banking, stocktrading, payments, and other financial activities. Furthermore, a mobiledevice used by an individual, a business, or a government agency canoften store confidential or private information in forms such aselectronic documents, text messages, access codes, passwords, accountnumbers, e-mail addresses, personal communications, phone numbers, andfinancial information.

In turn, it is more important to protect those devices against malware,malicious attacks and other exploits. Specifically, it would be helpfulto be able to identify vulnerabilities for a mobile communicationdevice, so that the user of the mobile communication device can bealerted if his or her device suffers from any exploitable weaknesses. Itis also important for an organization that relies on mobile devices tounderstand the state of their security and be able to respond tovulnerabilities on mobile devices in an efficient and effective manner.

Presently, current solutions for assessing the vulnerabilities of acomputer on a network focus on a conventional desktop, laptop, server,or other computing devices that often enjoy more processing power andmemory than a mobile communication device and generally have lessrestricted application environments than a mobile communication device.As such, these computing devices can often include local monitoringservices that can run in the background without overly taxing valuablecomputing resources. In addition, conventional computing devices areoften consistently tethered to a particular local network, such thatdevices can be remotely scanned over the local network for securityweaknesses. Mobile communication devices, on the other hand, are oftenconnected to public networks and switch between networks and networktypes, making remote, network-based security scans undesirable.

What is therefore needed is a way to provide similar protective servicesfor mobile communication devices in a manner that does not overly taxresources on the mobile communication device, and that extendsprotective services even when the mobile communication device is notconnected to a particular network or is not connected to any network.

There are many differences between mobile communication devices (e.g.operating systems, hardware capabilities, software configurations) thatmake it difficult to have a single system for accurately assessing thevulnerability of multiple types of devices. Additionally, many mobilecommunication devices are able to accept installation of variousthird-party software applications or “apps” that have been developed toextend the capabilities of the device. The installation of apps canalter the vulnerability state of a device, since each app may alter howand with which networks the mobile device communicates. What istherefore needed is a way to assess vulnerabilities of a mobilecommunication device that accounts for differences such as the operatingsystem, the make, model, configuration, or any installed software on themobile device. Also needed is a way for a user or administrator to viewthe security status of, remediate, and otherwise assess and manage thesecurity of multiple different mobile communication devices.

BRIEF DESCRIPTION OF THE FIGURES

The invention is illustrated by way of example and not limitation in thefigures of the accompanying drawings, in which like references indicatesimilar elements, and in which:

FIG. 1 is an exemplary block diagram depicting an embodiment of theinvention.

FIG. 2 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 3 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 4 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 5 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 6 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 7 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 8 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 9 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 10 is an exemplary flow diagram illustrating the steps of anembodiment of the invention.

FIG. 11 is an exemplary screenshot illustrating an embodiment of theinvention.

DETAILED DESCRIPTION

The invention is a system and a method for identifying, assessing, andresponding to vulnerabilities on or affecting a mobile communicationdevice. As will be discussed further below, a mobile communicationdevice may transmit certain information to a server, and the server maytransmit certain result information to the device that contains anassessment or identifies known or potential vulnerabilities affectingthe device. Additionally or alternatively, the server may transmitnotifications about possible or actual vulnerabilities affecting amobile communication device, which may include instructions forremediating any vulnerabilities identified as affecting the mobilecommunication device. Furthermore, the server may host a managementconsole that allows an administrator to view the security status ofmultiple mobile communication devices and take action to secure them ifnecessary.

It should be appreciated that the invention can be implemented innumerous ways, including as a process, an apparatus, a system, a device,a method, a computer readable medium such as a computer readable storagemedium containing computer readable instructions or computer programcode, or as a computer program product comprising a computer usablemedium having a computer readable program code embodied therein. Onewill appreciate that the mobile communication device described hereinmay include any computer or computing device running an operating systemfor use on handheld or mobile devices, such as smartphones, PDAs, mobilephones and the like. For example, a mobile communication device mayinclude devices such as the Apple iPhone®, the Palm Pre™, or any devicerunning the Android™ OS, Symbian OS®, Windows Mobile® OS, Palm OS® orPalm Web OS™.

In the context of this document, a computer usable medium or computerreadable medium may be any medium that can contain or store the programfor use by or in connection with the instruction execution system,apparatus or device. For example, the computer readable storage mediumor computer usable medium may be, but is not limited to, a random accessmemory (RAM), read-only memory (ROM), or a persistent store, such as amass storage device, hard drives, CDROM, DVDROM, tape, erasableprogrammable read-only memory (EPROM or flash memory), or any magnetic,electromagnetic, infrared, optical, or electrical system, apparatus ordevice for storing information. Alternatively or additionally, thecomputer readable storage medium or computer usable medium may be anycombination of these devices or even paper or another suitable mediumupon which the program code is printed, as the program code can beelectronically captured, via, for instance, optical scanning of thepaper or other medium, then compiled, interpreted, or otherwiseprocessed in a suitable manner, if necessary, and then stored in acomputer memory.

Applications, software programs or computer readable instructions may bereferred to as components or modules. Applications may be hardwired orhard coded in hardware or take the form of software executing on ageneral purpose computer such that when the software is loaded intoand/or executed by the computer, the computer becomes an apparatus forpracticing the invention. Applications may also be downloaded in wholeor in part through the use of a software development kit or toolkit thatenables the creation and implementation of the invention. In thisspecification, these implementations, or any other form that theinvention may take, may be referred to as techniques. In general, theorder of the steps of disclosed processes may be altered within thescope of the invention.

FIG. 1 is a block diagram illustrating an embodiment of a system foridentifying and assessing vulnerabilities on a mobile communicationdevice. In an embodiment, the system may include one or more mobilecommunication devices 101 connected on a cellular, wireless Internet orother network 121. One or more servers 151 may also have access tonetwork 121. The one or more servers 151 may receive one or more sets ofvulnerability identification information from the one or more mobilecommunication devices 101, and/or may transmit one or more sets ofresult information to the one or more mobile communication devices 101.In addition, the one or more servers 151 may have access to a datastorage 111 that stores information about mobile communication devicevulnerabilities. One will appreciate that data storage 111 may be adatabase, data table, file system or other memory store. Data storage111 may be hosted on any of the one or more servers 151, or may existexternally from the one or more servers 151, so long as the one or moreservers 151 have access to data storage 111. One will also appreciatethat the configuration of the system illustrated in FIG. 1 is merelyexemplary, and that other configurations are possible without departingfrom this disclosure or the scope of the invention. For example, servers151 or data storage 111 may be singular or plural, or may be physical orvirtualized.

One will appreciate that communication between mobile communicationdevice 101 and server 151 may utilize a variety of networking protocolsand security measures. In an embodiment, server 151 operates as an HTTPserver and the device 101 operates as an HTTP client. To secure the datain transit, mobile communication device 101 and server 151 may useTransaction Layer Security (“TLS”). Additionally, to ensure that mobilecommunication device 101 has authority to access server 151, and/or toverify the identity of mobile communication device 101, device 101 maysend one or more authentication credentials to server 151. For example,authentication credentials may include a username and password or anyother data that identifies mobile communication device 101 to server151. Authentication may allow server 151 to store specific information,such as vulnerability identification information, about mobilecommunication device 101, and may also provide a persistent view of thesecurity status of mobile communication device 101.

As previously mentioned, data storage 111 may be used to store sets ofinformation about mobile communication device vulnerabilities(“vulnerability information”), which may be transmitted in whole or inpart to one or more mobile communication devices in the form of “resultinformation.” As used herein, a vulnerability may include an exploitableweakness on a mobile communication device that may result from thedevice hardware or software. Vulnerabilities may arise due to weaknessesin the device's operating system, other software or hardware flaws inthe device, protocol implementation or specification flaws,misconfiguration of the device, software applications installed orstored on the device, or services provided through, to or by the device.Vulnerabilities may arise form the features of the device, such as fromthe presence of Bluetooth, infrared or Internet capabilities on thedevice, or other communication interfaces and protocols available on thedevice. Vulnerabilities may arise from weaknesses in the device'sinteraction with, flaws in, or misconfiguration of other services andsystems such as text messaging, voice mail, telephony, or other servicesand systems accessed through a mobile communication device. Informationabout a vulnerability, i.e., vulnerability information, may be stored indata storage 111 and accessed by server 151 or mobile communicationdevice 101. Data storage 111 may store general information about mobilecommunication device vulnerabilities, or may store information aboutvulnerabilities specific to a mobile communication device. As will bediscussed further below, sets of vulnerability information correspondingto vulnerabilities that could affect or actually affect the mobilecommunication device may be transmitted in the form of resultinformation, notifications, or both.

One will appreciate that as used herein, vulnerability information mayinclude the name, description, severity rating, security impact summaryand remediation instructions for a vulnerability. Vulnerabilityinformation may be included in the result information server 151transmits to mobile communication device 101 or may be stored in datastorage 111. Result information may include a list of vulnerabilitiesthat are known to affect mobile communication device 101, a list ofpotential vulnerabilities that may affect mobile communication device101, and a list of vulnerabilities that are known not to affect mobilecommunication device 101. Each entry in a list of vulnerabilities mayinclude some or all of the set of vulnerability information for avulnerability. As will be discussed in more detail below, the resultinformation may also include a binary assessment of mobile communicationdevice 101 (e.g., good or bad, “okay” or “not okay”), a threat score,remediation instructions for known or potential vulnerabilities, or mayinstruct display of a graduated icon that changes depending upon state(a sad face for a vulnerable mobile communication device, to a happyface for a “safe” mobile communication device). Vulnerabilityinformation may include criteria for determining if a mobilecommunication device 101 is affected. In an embodiment, vulnerabilityinformation may include information about a vulnerability such as atitle, a description, a security impact summary, human or computerreadable remediation instructions or a severity rating for thevulnerability.

As used herein, “vulnerability identification information” or“identification information” includes data that server 151 may use todetermine if mobile communication device 101 is susceptible to anyvulnerabilities. Such vulnerability identification information mayinclude the operating system and version for mobile communication device101; the firmware version of the mobile communication device 101, thedevice model for mobile communication device 101; carrier informationfor mobile communication device 101; authentication information; and/oruser information for the user of mobile communication device 101.Vulnerability identification information may also include a list offiles, software components, libraries and/or a list of the applicationsor other software installed on mobile communication device 101, as wellas other information related to these applications and software such asversion and configuration information, configuration information aboutthe mobile communication device 101, communications interfaces andprotocols in use by mobile communication device 101 (e.g., WiFi,Bluetooth, IR, SMS, MMS), cellular network information, cellular carrierinformation, the make and model of mobile communication device 101, andthe like.

In an embodiment, vulnerability information stored in data storage 111may have associated information that includes a description, a title, anoverview of the security impact, remediation instructions, and criteriafor affected firmware versions. In an embodiment, mobile communicationdevice 101 sends vulnerability identification information to server 151that includes the device's firmware version. Server 151 may utilize datastorage 111 to examine the vulnerability information stored therein anddetermine if the firmware version for mobile communication device 101matches the firmware version criteria for any vulnerabilities. If anyvulnerabilities match, server 151 may determine that mobilecommunication device 101 is vulnerable. Server 151 may then transmitresult information to the mobile communication device 101, as describedherein and shown in the Figures. In an embodiment, server 151 onlytransmits result information corresponding to vulnerabilities thataffect mobile communication device 101. In an embodiment, server 151transmits result information for all vulnerabilities that may affectdevice 101. In an embodiment, server 151 transmits result informationwhich contains all vulnerabilities that may affect device 101 and whichof those vulnerabilities actually do affect device 101. In anembodiment, the firmware version criteria for being affected by avulnerability includes the version of the firmware in which thevulnerability was fixed. One will appreciate that some vulnerabilitiesmay only affect certain firmware versions, and that once firmware hasbeen updated to a new version, some vulnerabilities which affectedprevious versions may no longer be of issue. In order to account forvariations in firmware, server 151 may detect and transmit informationfor vulnerabilities regardless of the firmware version on mobilecommunication device 101, thereby adding extra precautions.Alternatively, server 151 may only send result information for thosevulnerabilities that affect the version of firmware installed on mobilecommunication device 101, thereby being more specific.

For example, a certain vulnerability may affect a mobile communicationdevice having firmware version 1.0, but not a mobile communicationdevice with firmware version 2.0. Server 151 may receive informationabout the firmware version of mobile communication device 101, and ifthe firmware version is earlier than version 2.0, then mobilecommunication device 101 is determined to be susceptible to the certainvulnerability. However, if the firmware version for mobile communicationdevice 101 is 2.0 or higher, then mobile communication device 101 maynot be susceptible to the certain vulnerability. One will appreciatethat other variations are possible, and that the determination ofwhether to send more or less result information may be a settingspecified by an administrator, or may involve the application of logicdepending upon the severity of the vulnerability and the risks orbenefits of transmitting an overabundance of result information tomobile communication device 101. One will also appreciate that theamount of result information to transmit to mobile communication device101 may also depend upon the capabilities of mobile communication device101 or the bandwidth of the network.

In an embodiment, data storage 111 stores vulnerability information forat least two types of mobile devices 101. The two mobile device typesmay have different operating systems, firmware versions, model numbers,carrier information, authentication information, user information,configuration information, states, software applications, and the like.As a result, the vulnerability identification information for each ofthe at least two mobile devices will differ in some aspect. As such, inan embodiment, data storage 111 may store vulnerability information forvulnerabilities that may affect both of the two device types, includingvulnerabilities that may affect one device type but not the other. Onewill appreciate that data storage 111 may store vulnerabilityinformation for a variety of mobile communication devices, and will beable to provide information that will help identify, assess andremediate vulnerabilities for a variety of mobile communication devices.

When data storage 111 stores information about vulnerabilities that mayaffect multiple types of mobile communication devices, it is importantthat the transmitted result information not include informationregarding vulnerabilities that as a user may perceive as irrelevant to aparticular device. As such it is important that the list ofvulnerabilities that may affect a device not simply include allvulnerabilities stored by data storage 111. In an embodiment, avulnerability may affect a device if the device's vulnerabilityidentification information at least partially matches thevulnerability's criteria for affecting a device. Providing partiallymatching result information provides a conservative, or safer approachto detecting and identifying potential vulnerabilities, as it mayprovide a opportunity for further assessment and action (e.g. furtheranalysis conducted by software on a device), rather than only providingfull criteria matches.

In an embodiment, the partial match includes criteria related to adevice that does not change, is unlikely to change, or is irrespectiveof particular software versions, firmware versions, updates, andconfiguration. Such criteria may include the device's operating system,model, carrier, software applications installed, hardware capabilities,and the like. For example, data storage 111 may store information abouta vulnerability that affects a particular range of firmware versions ofthe Apple iPhone® OS. This vulnerability information may includecriteria that it affects the Apple iPhone® OS and criteria that itaffects specific firmware ranges of various device models. In anembodiment, the server 151 determines that the vulnerability does affectall devices running Apple iPhone® OS that match the vulnerabilityinformation's firmware version criteria, the vulnerability may affectdevices running any firmware version containing Apple iPhone® OS, andthe vulnerability may not affect any devices running Android™, WindowsMobile®, Symbian OS®, or other operating systems. One will appreciatethat other methods of determining what vulnerabilities stored by datastorage 111 may affect a device may be performed without departing fromthe scope of this disclosure.

FIGS. 2-10 are exemplary flow diagrams depicting various processembodiments. One will appreciate that the following figures andprocesses are merely exemplary, and that the invention may perform otherprocesses without departing from the scope of this disclosure. One willalso appreciate that unless otherwise stated, the performance of thesteps in the disclosed processes are not constrained by time. The timebetween two successive steps may differ from the time between two othersuccessive steps. Additionally, the time to perform each step may differeach time a step is performed. One will also appreciate that the amountof information as described herein is referred to as a “set ofinformation” or a plurality of sets of information. A set of informationmay include at least one quanta, data point or other quantifiable amountof information, but is not designed to limit or constrain the amount ofinformation discussed herein. In an embodiment, a set of vulnerabilityinformation may include multiple pieces of information that relate to agiven vulnerability, such as a title, a description, a threat rating,and criteria for the vulnerability to affect a device. In an embodiment,a set of result information may include a security status for a device,and a list of vulnerabilities that the device is vulnerable to, eachentry in the list comprising a set of vulnerability information.

FIG. 2 depicts and embodiment in which vulnerability information istransmitted to mobile communication device 101. In block 201, datastorage 111 stores a plurality of sets of vulnerability informationrelated to one or more mobile communication devices 101. In block 202,vulnerability information is transmitted to at least one mobilecommunication device 101 over network 121. One will appreciate that thetransmission of vulnerability information to the at least one mobilecommunication device 101 may be controlled by server 151 having accessto data storage 111. One will also appreciate that in block 202, thetransmitted vulnerability information may also be termed resultinformation.

FIG. 3 depicts an embodiment in which result information is transmittedto mobile communication device 101 after server 151 receivesvulnerability identification information from mobile communicationdevice 101. One will appreciate that the process illustrated in FIG. 3and described herein may be performed in addition to any of theprocesses disclosed herein, or may be performed separately from any ofthe processes disclosed herein. In block 201, data storage 111 stores aplurality of sets of vulnerability information related to one or moremobile communication devices 101. In block 301, server 151 receivesvulnerability identification information from at least one mobilecommunication device 101. In block 302, server 151 correlates thereceived set of vulnerability identification information to at least oneof the plurality of sets of vulnerability information to generate a setof result information which contains information about vulnerabilitiesthat affect or may affect the at least one mobile communication device101. This may include accessing data storage 111 by server 151. In block202, result information is transmitted to at least one mobilecommunication device 101 over network 121.

In an embodiment, the scope or type of result information transmitted byserver 151 may be general information, or may be specific informationabout vulnerabilities that may specifically affect mobile communicationdevice 101. As such, the result information transmitted to device 101may include all of the vulnerability information stored in data storage111, or may include a subset of all of the vulnerability informationstored in data storage 111. The option to transmit general or specificresult information may be an option set by an administrator, may dependupon the hardware or software constraints of the mobile communicationdevice, or may depend upon the bandwidth of the network connectingserver 151 to mobile communication device 101.

In an embodiment, determining which vulnerabilities specifically affectmobile communication device 101 may involve correlating thevulnerability identification information provided by mobilecommunication device 101 to the vulnerability information available toserver 151. As used herein, “correlating” vulnerability identificationinformation to vulnerability information may involve determining whetherthe vulnerability described by the vulnerability information affects adevice, whether it may affect a device, or whether it does not affect adevice. Determinations may be made through a variety of methods,including matching vulnerability identification information withvulnerability information and determining whether identificationinformation satisfies one or more criteria for vulnerability.Correlating may be performed by server 151 and/or data storage 111, andmay include applying logic, comparing operating systems, comparingversion identifiers, checking for the presence of specific software orother data on the mobile communication device, and the like. In anembodiment, correlating may utilize an identification of the hardware orspecifications of the mobile communication device. In an embodiment,correlating may also be performed by mobile device 101.

FIG. 4 is directed to a process in which data storage 111 is updatedwith new vulnerability information that may be transmitted as a new orsecond set of result information to affected mobile communicationdevices 101. As will discussed in more detail below, this process mayinclude the transmission of one or more notifications. One willappreciate that the process illustrated in FIG. 4 and described hereinmay be performed in addition to any of the processes disclosed herein,or may be performed separately from any of the processes disclosedherein. In block 201 of FIG. 4, data storage 111 stores a plurality ofsets of vulnerability information related to one or more mobilecommunication devices 101. In block 301 of FIG. 4, server 151 receivesidentification information for one of the one or more mobilecommunication devices 101. In an embodiment, server 151 stores thisidentification information in data storage 111. This stored informationmay be used in block 402 (discussed below) to determine if a newlyreceived vulnerability affects devices 101. In an embodiment, the datais used to present a status or administrative interface for the device.One will appreciate that storing vulnerability identification receivedby server 151 may apply to the other processes as well. For example, anytime server 151 receives vulnerability identification information, theserver 151 may store the information for use in generating andtransmitting user interfaces (e.g. web interfaces) or identifyingwhether a vulnerability affects a device 101 while the device 101 is notconnected to server 151.

In block 302 of FIG. 4, server 151 performs a correlating step toidentify vulnerabilities that affect or may affect the mobilecommunication device 101, which may include accessing data storage 111by server 151. As a result of correlating step in block 302, server 151may generate a set of result information. In block 202 of FIG. 4, theset of result information is transmitted to the affected mobilecommunication device 101 over network 121. In block 401, server 151 ordata storage 111 waits for and receives new vulnerability information.One will appreciate that there may not be a set time interval as to whenblock 401 is performed. After new vulnerability information is received,server 151 makes a determination whether the newly receivedvulnerability information affects any known mobile communication device101 having access to server 151 or data storage 111 (block 402). In anembodiment, the determination in block 402 may use the same method fordetermining if a vulnerability affects a device 101 as in thecorrelating block 302; however, instead of identifying whichvulnerabilities affect a given device 101, the server 151 may identifywhich devices 101 are affected by the newly received vulnerability. Inan embodiment, the server 151 determines which devices are vulnerable tothe newly received vulnerability by correlating vulnerabilityidentification information for each device stored in data storage 111 tothe vulnerability criteria for the newly received vulnerability. If thenew vulnerability information does affect any of the mobilecommunication devices 101 having access to server 151 or data storage111, then in block 403, server 151 transmits a notification of the newvulnerability or transmits information about the new vulnerability tothe affected mobile communication devices 101. If the new vulnerabilityinformation does not affect any of the mobile communication devices 101having access to server 151 or data storage 111, then server 151 or datastorage 111 will wait until new relevant vulnerability information isreceived (block 401).

Server 151 may transmit a notification to mobile communication device101 via a variety of mechanisms. A notification may be sent via email,text messaging, or through a client-server communication system asdescribed in U.S. patent application Ser. No. 12/372,719, entitled,“SYSTEM AND METHOD FOR REMOTELY SECURING OR RECOVERING A MOBILE DEVICE,”and incorporated in full herein. A notification may provide informationabout a vulnerability, information about a potential vulnerability, thestatus of a mobile communication device, information about remediationinstructions, or may request that the user of an affected mobilecommunication device perform some action to update the vulnerabilityinformation on the mobile communication device, or perform some actionto remediate the mobile communication device.

In an embodiment, a notification may contain information or aninstruction indicating that the mobile communication device 101 needs toconnect to server 151 in order to receive new vulnerability information.The notification may be directed to software resident on the mobilecommunication device 101, may include software readable remediationinstructions, and may be in the form of an SMS or may be sent via a pushnotification service, such as that provided by Apple Computer Inc. toits iPhone® devices. For example, mobile communication device 101 mayreceive a notification with instructions that the device should beupdated to protect against a new security risk. A specific applicationon the device may require an update, in which case the notification mayalso cause mobile communication device 101 to update the specificapplication without user intervention. In an embodiment, a notificationmay be directed to the user of the mobile communication device. This mayinclude a text message, push notification, or e-mail message containinghuman-readable information, or a voicemail or other verbal communicationdirected to the user of mobile communication device 101. Notifying amobile communication device 101 allows for rapid response to newvulnerabilities, thereby greatly increasing the effectiveness of systemsthat would otherwise rely on a scheduled or manually-initiated check forsecurity vulnerabilities.

FIG. 5 illustrates an embodiment in which server 151 may requireadditional information about a mobile communication device 101 in orderto confirm whether a vulnerability affects mobile communication device101. One will appreciate that the process illustrated in FIG. 5 anddescribed herein may build upon any of the processes discussed herein,or may be performed independently of any of the other processesdiscussed herein. In block 201 of FIG. 5, data storage 111 stores aplurality of sets of vulnerability information related to one or moremobile communication devices 101. One will appreciate that data storage111 may be accessed by server 151. In block 301 of FIG. 5, server 151receives identification information for a mobile communication device101. In block 302 of FIG. 5, server 151 correlates the receivedidentification information to the stored plurality of sets ofvulnerability information to determine which vulnerabilities affect ormay affect the mobile communication device 101, which may includeaccessing data storage 111 by server 151. Server 151 generates a set ofresult information that in block 202 of FIG. 5 is transmitted to themobile communication device 101 over network 121.

In block 401 of FIG. 5, server 151 or data storage 111 waits for andreceives new vulnerability information. In block 501, server 151 assesswhether there is enough information to determine which mobilecommunication devices may be affected by the newly receivedvulnerability information. If there is not enough information, then inblock 502, server 151 will request additional vulnerabilityidentification information from one or more mobile communication devices101, and will then receive the additional information from the one ormore mobile communication devices 101 in block 503. One will appreciatethat the request in block 502 may utilize notification mechanisms suchas those described above or may be performed the next time the mobilecommunication device 101 connects to the server 151. Once the additionalinformation is received, server 151 may make a determination whether thenewly received vulnerability information affects any of the one or moremobile communication devices 101 having access to server 151 or datastorage 111 (block 402). If the new vulnerability information doesaffect any of the one or more mobile communication devices 101 havingaccess to server 151 or data storage 111, then in block 403 of FIG. 5,the server 151 will transmit a notification of the new vulnerability tothe affected mobile communication devices 101, or may transmit anupdated, new or second set of result information regarding the newvulnerability. If the new vulnerability information does not affect anyof the mobile communication devices 101 having access to server 151 ordata storage 111, then server 151 or data storage 111 may wait until newrelevant vulnerability information is received (block 401 of FIG. 5).

One will appreciate that the process illustrated in FIG. 5 includes asituation in which server 151 receives operating system information froma mobile communication device 101. In an embodiment, this information isstored by server 151 in data storage 111 or other accessible storage.Later, after receiving new vulnerability information, server 151 maydetermine that based on the stored operating system information formobile communication device 101, the vulnerability could affect mobilecommunication device 101. However, server 151 may require additionalidentification information from mobile communication device 101 in orderto determine whether the device is actually affected. Server 151 mayrequest additional configuration information from mobile communicationdevice 101. Server 151 will receive the requested identificationinformation and then sends accurate vulnerability information to thedevice 101.

FIG. 6 is directed to a process in which a mobile communication device101 having access to server 151 or data storage 111 requestsvulnerability information from server 151. In block 601, mobilecommunication device 101 transmits a request to server 151 forvulnerability information over network 121. In block 602, mobilecommunication device 101 receives vulnerability information from server151. One will appreciate that server 151 may access data storage 111 inorder to gather and transmit the vulnerability information. In block603, mobile communication device 101 correlates the receivedvulnerability information to its own identification information, andmakes a determination whether any of the received vulnerabilityinformation is relevant to the mobile communication device 101. In thisembodiment, vulnerability information processing may thereby beperformed by the mobile communication device 101. In an embodiment, bothmobile communication device 101 and server 151 perform processing onvulnerability information. For example, the server 151 may sendvulnerability information to mobile communication device 101 based onthe operating system of mobile communication device 101. In anembodiment, server 151 may use information sent by device 101 (e.g. HTTPheader information) in the request 601 or information stored in datastorage 111 to determine the operating system of the device 101. Themobile communication device may then use additional information such asthe applications installed on the device, configuration information, andthe versions of software libraries to perform additional processing,correlating or analysis on the received vulnerability information. Onewill appreciate that a vulnerability may be rated as severe if thedevice's configuration makes the vulnerability exploitable by remoteparties; however, the vulnerability may be rated as less severe if thedevice's configuration leaves the vulnerability as not remotelyexploitable.

FIG. 7 is any exemplary flowchart of a process in which a mobilecommunication device 101 transmits vulnerability identificationinformation to server 151 (block 701), and in response, received resultinformation on (block 702). One will appreciate that this may requireaccess to data storage 111 by server 151. One will also appreciate thatthe process illustrated in FIG. 7 and described herein may be performedas part of any of the other processes described or illustrated herein,or may be performed independently of the other processes described orillustrated herein.

FIG. 8 is directed to a process in which a mobile communication device101 transmits additional vulnerability identification information toserver 151 in order to receive additional result information relevant tothe mobile communication device 101. One will appreciate that theprocess illustrated in FIG. 8 and disclosed herein may augment any ofthe other disclosed or illustrated processes. In block 701 of FIG. 8,mobile communication device 101 transmits vulnerability identificationinformation to server 151. In block 801, mobile communication device 101receives a request for additional identification information from server151. In block 802, mobile communication device 101 transmits additionalvulnerability identification information to server 151. In response,mobile communication device 101 receives correlated result informationfrom server 151 in block 702 of FIG. 8. One will appreciate that server151 may access data storage 111 in order to provide the relevant resultinformation for transmission to mobile communication device 101.

One will appreciate that the process illustrated in FIG. 8 contemplatesa situation in which a mobile communication device 101 first transmitsits operating system information to a server 151. Mobile communicationdevice 101 may then receive a request from server 151 for versioninformation pertaining to software libraries installed on the device101. Mobile communication device 101 may then send the requestedinformation to server 151 and may receive result information correlatedto the device's vulnerability given its specific software libraryversion information. If the software library versions installed onmobile communication device 101 are not affected by a specificvulnerability, the result information received by mobile communicationdevice 101 may indicate that the device 101 is not vulnerable to thatvulnerability. If, however, the software library versions are affectedby a specific vulnerability, then the result information received bymobile communication device 101 may indicate that mobile communicationdevice 101 is vulnerable and may contain instructions for how toremediate the issue.

FIG. 9 illustrates a process in which vulnerabilities on a mobilecommunication device 101 are remediated. One will appreciate that theprocess illustrated in FIG. 9 and described herein may be combined withany of the processes discussed herein, or may be performed independentlyof any of the other processes discussed herein. In block 201 of FIG. 9,data storage 111 stores a plurality of sets of vulnerability informationrelated to one or more mobile communication devices 101. In block 301 ofFIG. 9, server 151 receives vulnerability identification information fora mobile communication device 101. In block 302 of FIG. 9, server 151correlates the received vulnerability identification information tovulnerability information in order to generate a set of resultinformation about vulnerabilities affecting the mobile communicationdevice 101. This step may include accessing data storage 111 by server151. In block 202 of FIG. 9, result information is transmitted to themobile communication device 101 over network 121. In an embodiment, theresult information may include instructions for the user to remediatevulnerabilities that affect the device 101.

In block 901 of FIG. 9, a determination is made as to whether mobilecommunication device 101 is vulnerable. This determination may be madeusing logic resident on mobile communication device 101, or server 151may perform the analysis. In an embodiment, a device is only vulnerableif it is affected by vulnerabilities that have a certain level ofseverity. For example, if a device is only susceptible tolocally-exploitable vulnerabilities, it may not be considered vulnerablein block 901; however, if the device is vulnerable toremotely-exploitable vulnerabilities or has a virus installed, it may beconsidered vulnerable in block 901. If mobile communication device 101is vulnerable, then in block 902, server 151 may be set to wait forconfirmation that the mobile communication device 101 has beenremediated. Server 151 may be conditioned to wait for confirmation for acertain period of time (block 903).

If the time limit for receiving a remediation confirmation has beenexceeded, then in block 904, an action may be taken. For example, server151 may notify an administrator about the vulnerable mobilecommunication device and that the user has not taken action in thespecified period of time. In this example, an administrator may takemanual action such as sending a personal email or otherwise notifyingthe user to secure the device 101. In an embodiment, server 151 mayautomatically disable mobile communication device 101 in some fashion toprevent affecting other devices on the network 121 or to prevent furtherdamage. For example, server 151 may prevent mobile communication device101 from connecting to a specific network, email system, documentrepository, or other system. Alternatively, server 151 may disablemobile communication device 101 such that an administrator must verifythat the device is safe before it is can be used again. Some mechanismsby which the disablement can take place are disclosed in U.S. patentapplication Ser. No. 12/372,719, entitled, “SYSTEM AND METHOD FORREMOTELY SECURING OR RECOVERING A MOBILE DEVICE,” and U.S. patentapplication Ser. No. 12/255,632, entitled, “SECURE MOBILE PLATFORMSYSTEM,” both of which are incorporated in full herein. In anembodiment, the user of mobile communication device 101 may be notifiedby server 151 via email, text message or other means of communicationthat the mobile communication device is vulnerable and that correctiveaction was not taken within the prescribed time. The notification mayserve as a reminder to help the user take action and secure the device.In this fashion, the invention goes beyond simply updating a mobilecommunication device to ensure security, or periodically scanning mobilecommunication devices on the network for potential vulnerabilities. Asdescribed herein, the invention may provide a customized vulnerabilityassessment based upon the unique state and configuration of each mobilecommunication device on the network, and may provide notifications andremediation instructions based upon this unique state and configuration.

One will appreciate that other actions may be performed in order tooptimally secure a mobile device once it is known to be vulnerable. Theembodiments described herein may be combined as part of a securityresponse process. In an example, a user may receive a direct reminderafter one day if his or her device is determined to be vulnerable and isnot yet remediated. After two additional days, if the device is stillvulnerable, an administrator may be notified and the device disallowedaccess to email and the organization's VPN service. Once the device isremediated, the administrator may be notified and access to email andVPN may be automatically restored. Other examples are also possiblewithout departing from this disclosure or the scope of the invention.

If in block 903 of FIG. 9, server 151 received confirmation that avulnerability affecting mobile communication device 101 has beenremediated, or if in block 901, mobile communication device 101 is notvulnerable, then in block 401 of FIG. 9, server 151 may wait for receiptof new vulnerability information. In block 501 of FIG. 9, server 151 mayassess whether there is enough information to determine if mobilecommunication device 101 is affected by the newly received vulnerabilityinformation. If there is not enough information, then in block 502 ofFIG. 9, server 151 will request additional vulnerability identificationinformation from mobile communication device 101, and will then receivethe additional vulnerability identification information from mobilecommunication device 101 in block 503 of FIG. 9. Once the additionalvulnerability identification information is received, server 151 maymake a determination whether the newly received vulnerabilityinformation affects mobile communication device 101 (block 402 of FIG.9), thereby generating a new, updated or second set of resultinformation. If the new vulnerability information does affect mobilecommunication device 101, then in block 403 of FIG. 9, server 151 maysend a notification of the new vulnerability information to the affectedmobile communication device 101, or may send information relating to thenew vulnerability to mobile communication device 101. If the newvulnerability information does not affect mobile communication device101, then server 151 or data storage 111 will wait until new relevantvulnerability information is received (block 401 of FIG. 9). One willappreciate that the portions of the process for remediatingvulnerabilities present on the mobile communication device 101 may beperformed in conjunction with any of the other processes disclosedherein.

FIG. 10 is directed to a process for generating data for display, e.g.on a web interface. In an embodiment, a user of the mobile communicationdevice 101, administrator for a group of mobile communication devices101, administrator for server 151, or other party may wish to check thesecurity status of mobile communication devices 101 connected to thenetwork 121. This may be helpful for identifying which mobilecommunication devices are vulnerable, identifying which need manualremediation or intervention from an administrator, determining the riskposed by a new vulnerability, and performing other actions relevant tosecuring a group of mobile communication devices. It may also be helpfulto provide a single graphical user interface that displays informationon mobile communication devices having access to server 151.

In block 201 of FIG. 10, data storage 111 stores a plurality of sets ofvulnerability information that may be accessed by server 151. In block301 of FIG. 10, server 151 receives vulnerability identificationinformation for one or more mobile communication devices 101 connectedto network 121. In block 1001, server 151 receives a request for thestatus of vulnerabilities for the one or more mobile communicationdevices 101. This request may originate from one of the one or moremobile communication devices 101, or from a web interface. In block 302of FIG. 10, server 151 correlates the received set of vulnerabilityidentification information to at least one of the plurality of sets ofvulnerability information to identify vulnerabilities that affect or mayaffect any of the one or more mobile communication devices 101 connectedto server 151 on network 121. In block 1002, server 151 transmits thestatus of vulnerabilities for any of the one or more mobilecommunication devices 101 for display on a web page or other interface.One will appreciate that the status may include whether any of thevulnerabilities have been remediated, and if not, which mobilecommunication device 101 still suffers from vulnerabilities that havenot been remediated. The actions in block 302 may be performed beforeserver 151 receives a request for vulnerability status. The result ofthe correlation may be stored by the server 151 so that when the serverreceives a request for vulnerability status, the server 151 recalls theprevious results. The storage may be in a database, in-memory cache, orother method of storing and recalling data available to server 151.

In an embodiment, the data transmitted by server 151 in block 1002 ofFIG. 10 may pertain to an individual mobile communication device,multiple devices, or a group of devices. The data may includeinformation about specific individual devices or aggregated informationrelating to multiple devices. The information about an individual devicemay include the device's security status (e.g. vulnerable/notvulnerable, severity of vulnerability, number of unremediatedvulnerabilities), software version information, phone number, count ofsecurity events in a time period, or last time communicating with server151. Aggregated information relating to a group of devices may includethe percentage of devices in the group that are vulnerable, the numberof devices in the group that are vulnerable, the overall risk level ofthe group, or other information that can be combined between specificdevices in the group. Server 151 may automatically group devices usingcriteria such as common characteristics (e.g. operating system type,operating system version, having the presence of certain software,having a certain configuration, etc.), or common security statuses (e.g.being vulnerable, being not vulnerable, being affected by a specificvulnerability, being out of compliance, awaiting remediation, etc.).

In an embodiment, the data transmitted by server 151 in block 1002 ofFIG. 10 may be selected by receiving searching or sorting information inthe request 1001. The search or sort may reference any informationstored by the server relating to specific devices. For example, a usermay search for all devices with a specific piece of software installedor may sort devices based on highest severity. In an embodiment, thedata transmitted by server 151 in block 1002 includes a prioritized listof current security issues. This list may also include recommendedactions to remediate the issues and the ability to initiate suchactions. For example, in a large mobile device deployment, the list ofcurrent issues may include iPhone® vulnerability that is severe andaffects 1000 devices, an Android™ vulnerability that is of moderateseverity and affects 1200 devices, a Windows Mobile vulnerability thatis severe and affects 100 devices, and a Blackberry vulnerability thatis of low severity and affects 3000 devices. The prioritization in thiscase takes into account both the severity of the vulnerability and thenumber of devices that are part of the deployment and affected by thevulnerability.

In an embodiment, server 151 may transmit reports based on securitystatus information available at the server. The reports may show changesin security status over time or show a current summary. Some examplereports include the number of vulnerable of devices with respect totime, the current number of vulnerable devices with each severity level,the current number of vulnerable devices broken down by operating systemtype, and a list of contact information for users with the most severelyvulnerable devices.

In an embodiment, server 151 may transmit security related events thatare generated both by clients and by server 151 due to automatic oradministrative action. The events may be displayed, gathered, processed,or otherwise interacted with as disclosed in U.S. patent applicationSer. No. 12/255,635, entitled, “SECURITY STATUS AND INFORMATION DISPLAYSYSTEM,” which is incorporated in full herein.

In an embodiment, server 151 allows an administrator to perform actionsrelated to a device or group of devices. Actions that may be performedinclude notifying the user of the device via a push notification, textmessage, email, or another messaging system; disabling the device;disabling the device's access to a service, potentially using amechanism disclosed in U.S. patent application Ser. No. 12/255,632,entitled, “SECURE MOBILE PLATFORM SYSTEM”; or those disclosed in U.S.patent application Ser. No. 12/372,719, entitled, “SYSTEM AND METHOD FORREMOTELY SECURING OR RECOVERING A MOBILE DEVICE,” both of which areincorporated in full herein.

In an embodiment, server 151 allows an administrator to configure howthe server operates. One such configuration may include custom triggersor alerts on certain events (e.g. devices not remediating in a period oftime) that will result in logging and administrator notification viaemail, text message, or other messaging medium. Other examples ofconfiguration options include: the time period the server waits beforenotifying an administrator of an un-remediated vulnerable device, theemail address or addresses administrators should be notified at, howoften to remind users of vulnerable devices that they need to takeremediation actions, what method of contact server 151 should use toremind users (e.g. SMS, E-mail, push notification service), how theserver interacts with e-mail or VPN services to disable access for aspecific vulnerable device, and other ways of controlling thefunctionality disclosed herein.

In an embodiment, vulnerability identification information is stored byserver 151 so that, in the case of a new vulnerability, server 151 candetermine whether the device is vulnerable, not vulnerable, orpotentially vulnerable based on the information is has. In anembodiment, the server stores vulnerability identification informationon data storage 111. This allows an IT admin to get an instant pictureof the security risk of their device deployment in the case of a newemerging vulnerability. Such rapid understanding is critical toprioritize response effort in the case of a rapidly spreading worm orsevere vulnerability.

FIG. 11 is an exemplary screenshot of result information being displayedon a mobile communication device 101. As shown, two vulnerabilities havebeen identified as affecting the mobile communication device. One willappreciate that these vulnerabilities may have been identified by server151 after receipt of vulnerability identification information frommobile communication device 101, as described above and illustrated inthe Figures. As previously discussed, the identified vulnerabilities mayspecifically affect mobile communication device 101 because of itsparticular operating system version, firmware version, or software, ormay be a general vulnerability that affects all similar makes and modelsof mobile communication device 101. As shown, multiple vulnerabilitiesare shown to not affect the mobile communication device 101. In anembodiment, these vulnerabilities are vulnerabilities that may affectsimilar makes and models of mobile device but do not affect the specificdevice 101. In an embodiment, result information display 1101 may linkto another screen or to a website with more information on avulnerability, including instructions on how to remediate thevulnerability. In an embodiment, the result information display 1101 mayoccur due to the result of the device 101 receiving result informationsent by the server in response to a request from the device 101. In anembodiment, the result information display 1101 may occur due to thedevice receiving a notification that the device 101 is vulnerable. Onewill appreciate that other situations may prompt the display of resultinformation on device 101 without departing from this disclosure. Onewill appreciate that other screen layouts are possible, and that thescreen depicted in FIG. 11 is not meant to limit the invention in anyfashion.

In the description above and throughout, numerous specific details areset forth in order to provide a thorough understanding of the invention.It will be evident, however, to one of ordinary skill in the art, thatthe invention may be practiced without these specific details. In otherinstances, well-known structures and devices are shown in block diagramform to facilitate explanation. The description of the preferredembodiments is not intended to limit the scope of the claims appendedhereto. Further, in the methods disclosed herein, various steps aredisclosed illustrating some of the functions of the invention. One willappreciate that these steps are merely exemplary and are not meant to belimiting in any way. Other steps and functions may be contemplatedwithout departing from this disclosure or the scope of the invention.

What is claimed is:
 1. A method comprising: a) providing at least oneserver that accesses a data storage storing a plurality of sets ofvulnerability information; b) receiving, at the at least one server, aset of vulnerability identification information about a mobilecommunication device; c) correlating, by the at least one server, thereceived set of vulnerability identification information to at least oneof the plurality of sets of vulnerability information to generate afirst set of result information; and, d) transmitting, by the at leastone server, the first set of result information.
 2. The method of claim1, wherein the vulnerability identification information is informationselected from the group consisting of an operating system type, anoperating system version, a firmware version, a device model, carrierinformation, authentication information, user information, configurationinformation for the mobile communication device, hardware information, alist of files, a list of software components, a list of libraries, and alist of software applications on the mobile communication device.
 3. Themethod of claim 1, wherein vulnerability information is informationselected from the group consisting of a name, a description, aremediation instruction, a severity rating, a security impact summary,and a criterion for being vulnerable.
 4. The method of claim 1, furthercomprising the step of: e) transmitting, by the at least one server tothe mobile communication device, a notification about the first set ofresult information.
 5. The method of claim 4, wherein the notificationincludes an instruction related to the first set of result information.6. The method of claim 1, further comprising the steps of: e) updatingat least one of the plurality of sets of vulnerability information onthe data storage to form a plurality of updated sets of vulnerabilityinformation; f) after the step of transmitting, by the at least oneserver, the first set of result information, correlating, by the atleast one server, the received set of vulnerability identificationinformation to the plurality of updated sets of vulnerabilityinformation to generate a second set of result information; and, g)transmitting, by the at least one server, the second set of resultinformation.
 7. The method of claim 1, further comprising the steps of:e) updating at least one of the plurality of sets of vulnerabilityinformation on the data storage to form a plurality of updated sets ofvulnerability information; f) after the step of transmitting, by the atleast one server, the first set of result information, correlating, bythe at least one server, the received set of vulnerabilityidentification information to the plurality of updated sets ofvulnerability information to generate a second set of resultinformation; and, g) transmitting, by the at least one server to themobile communication device, a notification about the second set ofresult information.
 8. The method of claim 1, further comprising thesteps of: e) receiving, at the data storage, a new set of vulnerabilityinformation to form an updated plurality of sets of vulnerabilityinformation; f) after the step of transmitting, by the at least oneserver, the first set of result information, correlating, by the atleast one server, the received set of vulnerability identificationinformation to the updated plurality of sets of vulnerabilityinformation to generate a second set of result information; and, g)transmitting, by the at least one server, the second set of resultinformation.
 9. The method of claim 1, further comprising the steps of:e) receiving, at the data storage, a new set of vulnerabilityinformation to form an updated plurality of sets of vulnerabilityinformation; f) after the step of transmitting, by the at least oneserver, the first set of result information, correlating, by the atleast one server, the received set of vulnerability identificationinformation to the updated plurality of sets of vulnerabilityinformation to generate a second set of result information; and, g)transmitting, by the at least one server to the mobile communicationdevice, a notification about the second set of result information.
 10. Amethod comprising: a) transmitting, from a mobile communication device,a set of vulnerability identification information to at least one serverthat accesses a data storage storing a plurality of sets ofvulnerability information; and, b) receiving, at the mobilecommunication device from the at least one server, a first set of resultinformation that correlates to the transmitted set of vulnerabilityidentification information.
 11. The method of claim 10, wherein thevulnerability identification information is information selected fromthe group consisting of an operating system type, an operating systemversion, a firmware version, a device model, carrier information,authentication information, user information, configuration informationfor the mobile communication device, hardware information, a list offiles, a list of software components, a list of libraries, and a list ofsoftware applications on the mobile communication device.
 12. The methodof claim 10, wherein vulnerability information is information selectedfrom the group consisting of a name, a description, a remediationinstruction, a severity rating, a security impact summary, and acriterion for being vulnerable.
 13. The method of claim 10, furthercomprising the step of: c) receiving, at the mobile communication devicefrom the at least one server, a notification about the first set ofresult information.
 14. The method of claim 13, wherein the notificationincludes an instruction related to the first set of result information.15. The method of claim 13, further comprising the step of: d)displaying, on the mobile communication device, at least a portion ofthe received notification.
 16. The method of claim 10, furthercomprising the step of: c) receiving, at the mobile communication devicefrom the at least one server, a notification about a second set ofresult information.
 17. A method comprising: a) providing at least oneserver that accesses a data storage storing a plurality of sets ofvulnerability information; b) receiving, at the at least one server, afirst set of vulnerability identification information about a firstmobile communication device; c) correlating, by the at least one server,the first set of vulnerability identification information to at leastone of the plurality of sets of vulnerability information to generate afirst set of result information; and, d) transmitting, by the at leastone server, the first set of result information; e) receiving, at the atleast one server, a second set of vulnerability identificationinformation about a second mobile communication device, wherein thesecond set of vulnerability identification information differs from thefirst set of vulnerability identification information; f) correlating,by the at least one server, the second set of vulnerabilityidentification information to at least one of the plurality of sets ofvulnerability information to generate a second set of resultinformation; and, g) transmitting, by the at least one server, thesecond set of result information.
 18. The method of claim 17, whereinthe vulnerability identification information is information selectedfrom the group consisting of an operating system type, an operatingsystem version, a firmware version, a device model, carrier information,authentication information, user information, configuration informationfor the mobile communication device, hardware information, a list offiles, a list of software components, a list of libraries, and a list ofsoftware applications on the mobile communication device.
 19. The methodof claim 17, wherein vulnerability information is information selectedfrom the group consisting of a name, a description, a remediationinstruction, a severity rating, a security impact summary, and acriterion for being vulnerable.
 20. A system comprising: a data storagestoring a plurality of sets of vulnerability information; a server foraccessing the data storage, for receiving one or more sets ofvulnerability identification information about one or more mobilecommunication devices, for correlating the one or more sets of receivedvulnerability identification information to at least one of theplurality of sets of vulnerability information to generate one or moresets of result information, for transmitting the one or more sets ofresult information, and for transmitting one or more notifications aboutthe one or more sets of result information; and, a network connectingthe at least one server, data storage, and the plurality of mobilecommunication devices.
 21. The system of claim 20, further comprising auser interface for monitoring the plurality of mobile communicationdevices to identify which of the plurality of mobile communicationdevices is vulnerable.
 22. The system of claim 20, wherein vulnerabilityinformation is information selected from the group consisting of a name,a description, one or more remediation instructions, a severity rating,a security impact summary, and one or more criteria for beingvulnerable.
 23. A method comprising: a) providing at least one serverthat accesses a data storage storing a plurality of sets ofvulnerability information; b) receiving, at the at least one server, aset of vulnerability identification information about a mobilecommunication device; c) correlating, by the at least one server, thereceived set of vulnerability identification information to at least oneof the plurality of sets of vulnerability information to generate afirst set of result information; and, d) transmitting, by the at leastone server to the mobile communication device, a notification about thefirst set of result information.
 24. The method of claim 23, wherein thevulnerability identification information is information selected fromthe group consisting of an operating system type, an operating systemversion, a firmware version, a device model, carrier information,authentication information, user information, configuration informationfor the mobile communication device, hardware information, a list offiles, a list of software components, a list of libraries, and a list ofsoftware applications on the mobile communication device.
 25. The methodof claim 23, wherein vulnerability information is information selectedfrom the group consisting of a name, a description, a remediationinstruction, a severity rating, a security impact summary, and acriterion for being vulnerable.
 26. The method of claim 23, furthercomprising the steps of: e) receiving, at the data storage, a new set ofvulnerability information to form an updated plurality of sets ofvulnerability information; f) correlating, by the at least one server,the received set of vulnerability identification information to theupdated plurality of sets of vulnerability information to generate asecond set of result information; and, g) transmitting, by the at leastone server, the second set of result information.
 27. The method ofclaim 23, further comprising the steps of: e) receiving, at the datastorage, a new set of vulnerability information to form an updatedplurality of sets of vulnerability information; f) correlating, by theat least one server, the received set of vulnerability identificationinformation to the updated plurality of sets of vulnerabilityinformation to generate a second set of result information; and, g)transmitting, by the at least one server to the mobile communicationdevice, a notification about the second set of result information.
 28. Amethod comprising: accessing, by a server, a data storage storing aplurality of sets of vulnerability information, the vulnerabilityinformation including descriptions of known vulnerabilities; receiving,by the server, a plurality of sets of vulnerability identificationinformation corresponding to a plurality of mobile communicationsdevices; correlating, by the server, the received plurality of sets ofvulnerability identification information to the plurality of sets ofvulnerability information accessed from the data storage to generate aset of result information; transmitting, by the server, the set ofresult information for display to an administrator; receiving, by theserver from the administrator in response to the administrator's reviewof at least a subset of the set of result information, instructions toperform a first action to remediate a vulnerability of at least one ofthe plurality of mobile communications devices.
 29. The method of claim28, wherein the action to remediate includes instructing the at leastone of the plurality of mobile communications devices to connect to theserver.
 30. The method of claim 29, wherein the action to remediateincludes instructing the at least one of the plurality of mobilecommunications devices to connect to the server to receive newvulnerability information.
 31. The method of claim 28 wherein the actionto remediate initiates, without user intervention, an update of anapplication on the at least one of the plurality of mobilecommunications devices.
 32. The method of claim 28 further comprising:performing, by the server, the first action to remediate a vulnerabilityof at least one of the plurality of mobile communications devices;waiting, by the server, for a confirmation related to the performedfirst action from the at least one of the plurality of mobilecommunications devices; when a first threshold value of time has passedwithout receiving the confirmation, performing, by the server, a secondaction to remediate a vulnerability of the at least one of the pluralityof mobile communications devices.
 33. The method of claim 32, whereinthe first action or the second action includes one of: notifying anadministrator of the at least one of the plurality of mobilecommunications devices; notifying a user of the at least one of theplurality of mobile communications devices; automatically disabling theat least one of the plurality of mobile communications devices; andpreventing the at least one of the plurality of mobile communicationsdevices from making a connection.
 34. The method of claim 32, whereinthe first action or the second action includes one of: automaticallydisabling the at least one of the plurality of mobile communicationsdevices either partially or fully and preventing the at least one of theplurality of mobile communications devices from making a connection, themethod further comprising: requiring, by the server, a verification thatthe at least one of the plurality of mobile communications devices issecure before the mobile communications device is re-enabled or allowedto make the connection.
 35. The method of claim 28, wherein the firstaction includes initiating a pre-defined security response process. 36.The method of claim 35, wherein the pre-defined security responseprocess includes: notifying, by the server, a user of a vulnerability inthe user's mobile communications device; providing the user withinstructions to remediate the vulnerability; after a first thresholdperiod of time has passed without receiving confirmation that thevulnerability has been remediated, reminding, by the server, the user ofthe vulnerability; and after a second threshold period of time withoutreceiving confirmation that the vulnerability has been remediated,performing, by the server, at least one of automatically disabling theuser's mobile communications device either partially or fully andpreventing the user's mobile communications device from making aconnection.
 37. The method of claim 28 further comprising: providing, bythe server, a graphical user interface for displaying the subset of theset of result information and wherein the instructions received by theserver from the administrator are received through the graphical userinterface.
 38. The method of claim 37, wherein the subset of the set ofresult information includes, for each of the plurality of mobilecommunications devices, at least one of: a device security status; asoftware version; a count of security events in a pre-determined timeperiod; or a time period since a last communication between the mobilecommunications device and the server.
 39. The method of claim 37,wherein the subset of the set of result information includes aggregatedinformation related to the plurality of mobile communications devices.40. The method of claim 39, wherein the aggregated information includesat least one of: a percentage of devices in the plurality of mobilecommunications devices that are vulnerable, or a number of devices inthe plurality of mobile communications devices that are vulnerable. 41.The method of claim 39, wherein the subset of result informationcorresponds to a subset of the plurality of mobile communicationsdevices, the subset of the plurality of mobile communications devicesbeing chosen based on a commonality including at least one of: acharacteristic of the mobile communications devices, or a securitystatus of the mobile communications devices.
 42. A system comprising: adata storage storing a plurality of sets of vulnerability information,the vulnerability information including descriptions of knownvulnerabilities; a server for performing the steps of: accessing thedata storage storing a plurality of sets of vulnerability information,receiving a plurality of sets of vulnerability identificationinformation corresponding to a plurality of mobile communicationsdevices, correlating the received plurality of sets of vulnerabilityidentification information to the plurality of sets of vulnerabilityinformation accessed from the data storage to generate a set of resultinformation, transmitting the set of result information for display toan administrator, and receiving, from the administrator in response tothe administrator's review of at least a subset of the set of resultinformation, instructions to perform a first action to remediate avulnerability of at least one of the plurality of mobile communicationsdevices; and a network connecting the server, data storage, and theplurality of mobile communications devices.
 43. The system of claim 42,wherein the server is further for performing the steps of: performingthe first action to remediate a vulnerability of at least one of theplurality of mobile communications devices; waiting for a confirmationrelated to the performed first action from the at least one of theplurality of mobile communications devices; when a first threshold valueof time has passed without receiving the confirmation, performing, bythe server, a second action to remediate a vulnerability of the at leastone of the plurality of mobile communications devices.
 44. The system ofclaim 43, wherein the first action or the second action includes one of:notifying an administrator of the at least one of the plurality ofmobile communications devices; notifying a user of the at least one ofthe plurality of mobile communications devices; automatically disablingthe at least one of the plurality of mobile communications devices; andpreventing the at least one of the plurality of mobile communicationsdevices from making a connection.
 45. The system of claim 43, whereinthe first action or the second action includes one of: automaticallydisabling the at least one of the plurality of mobile communicationsdevices either partially or fully and preventing the at least one of theplurality of mobile communications devices from making a connection, andwherein the server is further for performing the steps of: requiring averification that the at least one of the plurality of mobilecommunications devices is secure before the mobile communications deviceis re-enabled or allowed to make the connection.
 46. The system of claim42 wherein the server is further for performing the steps of: providinga graphical user interface for displaying the subset of the set ofresult information and wherein the instructions received by the serverfrom the administrator are received through the graphical userinterface.
 47. The system of claim 46, wherein the subset of the set ofresult information includes, for each of the plurality of mobilecommunications devices, at least one of: a device security status; asoftware version; a count of security events in a pre-determined timeperiod; or a time period since a last communication between the mobilecommunications device and the server.
 48. The system of claim 46,wherein the subset of the set of result information includes aggregatedinformation related to the plurality of mobile communications devices.49. The system of claim 48, wherein the aggregated information includesat least one of: a percentage of devices in the plurality of mobilecommunications devices that are vulnerable, or a number of devices inthe plurality of mobile communications devices that are vulnerable. 50.The system of claim 48, wherein the subset of result informationcorresponds to a subset of the plurality of mobile communicationsdevices, the subset of the plurality of mobile communications devicesbeing chosen based on a commonality including at least one of: acharacteristic of the mobile communications devices, or a securitystatus of the mobile communications devices.
 51. A non-transitory,computer-readable storage medium having stored thereon a plurality ofinstructions, which, when executed by a processor of a server, cause theserver to perform the steps of: accessing a data storage storing aplurality of sets of vulnerability information, the vulnerabilityinformation including descriptions of known vulnerabilities; receiving aplurality of sets of vulnerability identification informationcorresponding to a plurality of mobile communications devices;correlating the received plurality of sets of vulnerabilityidentification information to the plurality of sets of vulnerabilityinformation accessed from the data storage to generate a set of resultinformation; transmitting the set of result information for display toan administrator; and receiving, from the administrator in response tothe administrator's review of at least a subset of the set of resultinformation, instructions to perform a first action to remediate avulnerability of at least one of the plurality of mobile communicationsdevices.
 52. The computer-readable storage medium of claim 51, theinstructions further causing the server to perform the steps of:performing the first action to remediate a vulnerability of at least oneof the plurality of mobile communications devices; waiting for aconfirmation related to the performed first action from the at least oneof the plurality of mobile communications devices; and when a firstthreshold value of time has passed without receiving the confirmation,performing a second action to remediate a vulnerability of the at leastone of the plurality of mobile communications devices.
 53. Thecomputer-readable storage medium of claim 52, wherein the first actionor the second action includes one of: notifying an administrator of theat least one of the plurality of mobile communications devices;notifying a user of the at least one of the plurality of mobilecommunications devices; automatically disabling the at least one of theplurality of mobile communications devices; and preventing the at leastone of the plurality of mobile communications devices from making aconnection.
 54. The computer-readable storage medium of claim 52,wherein the first action or the second action includes one of:automatically disabling the at least one of the plurality of mobilecommunications devices either partially or fully and preventing the atleast one of the plurality of mobile communications devices from makinga connection, and wherein the server is further for performing the stepsof: requiring a verification that the at least one of the plurality ofmobile communications devices is secure before the mobile communicationsdevice is re-enabled or allowed to make the connection.
 55. Thecomputer-readable storage medium of claim 51, the instructions furthercausing the server to perform the steps of: providing a graphical userinterface for displaying the subset of the set of result information andwherein the instructions received by the server from the administratorare received through the graphical user interface.
 56. Thecomputer-readable storage medium of claim 55, wherein the subset of theset of result information includes, for each of the plurality of mobilecommunications devices, at least one of: a device security status; asoftware version; a count of security events in a pre-determined timeperiod; or a time period since a last communication between the mobilecommunications device and the server.
 57. The computer-readable storagemedium of claim 55, wherein the subset of the set of result informationincludes aggregated information related to the plurality of mobilecommunications devices.
 58. The computer-readable storage medium ofclaim 57, wherein the aggregated information includes at least one of: apercentage of devices in the plurality of mobile communications devicesthat are vulnerable, or a number of devices in the plurality of mobilecommunications devices that are vulnerable.
 59. The computer-readablestorage medium of claim 57, wherein the subset of result informationcorresponds to a subset of the plurality of mobile communicationsdevices, the subset of the plurality of mobile communications devicesbeing chosen based on a commonality including at least one of: acharacteristic of the mobile communications devices, or a securitystatus of the mobile communications devices.